the addressing scheme of your condition is wrong. Your condition is
ctx.payload.aggregations.managedobjectref.timerange.buckets.0.doc_count
the first part ctx.payload.aggregations.managedobjectref is correct, however before reaching the timerange field, you missed that there is a buckets array where each element contains a timerange field.